SB2026092128 - Multiple vulnerabilities in Apache Neethi

Main Vulnerability Database SB2026092128

SB2026092128 - Multiple vulnerabilities in Apache Neethi

Published: September 21, 2026

Security Bulletin ID SB2026092128

CSH Severity

Medium

Patch available

YES

Number of vulnerabilities 5

Exploitation vector Remote access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 5 vulnerabilities.

1) Uncontrolled Recursion (CVE-ID: CVE-2026-91863)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the Apache Neethi WS-Policy parser when parsing a crafted WS-Policy document with deeply nested policy elements. A remote attacker can supply a specially crafted WS-Policy document to exhaust the thread stack and crash the parser.

2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-91864)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to failure to enforce size limits in WS-Policy assertion processing when processing a specially crafted WS-Policy document. A remote attacker can submit a specially crafted WS-Policy document to exhaust heap memory.

3) Resource exhaustion (CVE-ID: CVE-2026-91865)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in Apache Neethi policy normalization when processing a crafted WS-Policy document containing repeated policy references. A remote attacker can supply a crafted WS-Policy document to cause a denial of service.

4) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-91866)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in Neethi's policy-intersection when processing a specially crafted pair of WS-Policy documents. A remote attacker can provide a specially crafted pair of WS-Policy documents to cause a denial of service.

5) Resource exhaustion (CVE-ID: CVE-2026-91867)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a missing total transfer timeout in remote policy reference fetching when fetching a remote policy reference from a server that slowly trickles bytes. A remote attacker can slowly transmit a remote policy reference to cause a denial of service.

Remediation

Install update from vendor's website.

References